Zotero Manager

• Risk level: Low
• Analyzed: Apr 16, 2026, 12:23 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's files and runtime instructions are consistent with a Zotero integration: it reads a Zotero API key from a config file or env var and talks to local (localhost) and official Zotero endpoints; nothing appears to request unrelated credentials or contact unexpected external hosts.

This skill appears to do what it says: it needs a Zotero API key (or the Zotero local API enabled) and will read that key from ~/.config/zotero (or from the ZOTERO_API_KEY env var) and call the Zotero APIs including local localhost:23119 and official zotero domains. Before installing: (1) Verify you are comfortable storing a Zotero API key in your home config directory or env var; use a read-only token (Read Library) as recommended. (2) Inspect and, if desired, remove or update the hardcoded Windows workspace path references in the scripts so they don't point to another user's directory. (3) Confirm you trust the author/source (homepage is missing). If you have any doubt, review the three Python files (zotero_search.py, zotero_import.py, zotero_diagnose.py) locally before running and rotate your Zotero token after testing. If you want the metadata to be more transparent, ask the publisher to declare the expected env var (ZOTERO_API_KEY) and config-file locations in the registry metadata.